AI agents Beta

Every AI agent, accounted for.

Copilot Studio, Foundry and custom agents from Microsoft Entra Agent ID, the Agent 365 registry and Defender – plus the coding assistants running on your endpoints.

Cloud agents

A policy for the agent identity doesn’t apply to its agent user. And “All users” doesn’t include agent users. Gapsio rates both separately.

BlueprintContoso Agent Platform3 agents
Agent identityInvoice TriageProtected
Agent userinvoice-triage@contoso.comNot covered

Local agents

Local agents run with the rights of the signed-in user, so Conditional Access doesn’t reach them. What matters is the device and how the agent is configured.

CursorDEV-LT-0388 · a.schulz
Auto-approve
On
MCP servers
3, 2 without a fixed version
npx -y @modelcontextprotocol/server-filesystem
Device
Tamper off, 2 local exclusions
Gapsio Conditional Access for agents: policies and agents not effectively protected
Conditional Access for agents: which policies cover agent identities and agent users – and which agents are left out.
  • Agents without Conditional Access or sponsor
  • Orphaned agent users and unknown blueprints
  • Cloud agents without an Entra Agent ID
  • Security defaults that bypass Conditional Access

See it in your own tenant.

Read-only, self-hosted in your Azure subscription, running in minutes. Every check is free.

Get started All modules